# How to force HTTPS

On TurboStack you do not need to write a redirect to force HTTPS - it is handled for you. Once a
application has an active certificate, the platform serves it over HTTPS and redirects HTTP to HTTPS
automatically.

## Make sure HTTPS is active

Give the application a certificate by setting `cert_type: letsencrypt` (the default for most
applications) and publishing - see
[TLS certificates](../../platform/hosts/applications/tls-certificates.md). Once the certificate is
issued, HTTP requests are redirected to HTTPS.

> [!NOTE]
> Because the redirect is done at the web-server layer, you do not need an application plugin for it
> (for example, remove the redundant `really-simple-ssl` plugin on WordPress). Do not add your own HTTP-to-HTTPS redirect
> in custom Nginx config - it would duplicate the platform's and can cause redirect loops.

## Point your application at HTTPS

So your app generates `https://` links and avoids mixed-content warnings, set its site or base URL to
the `https://` address (for example the WordPress Site Address, or the framework's `APP_URL`).

## Optional: enforce HTTPS in the browser with HSTS

To tell browsers to always use HTTPS for your domain, add the `Strict-Transport-Security` header -
see [Add custom HTTP headers](custom-http-headers.md):

```nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
```

> [!WARNING]
> Enable HSTS only when HTTPS works on the domain and its subdomains. It is cached by browsers for a
> long time and is hard to undo.

## Verify

An HTTP request should answer with a `301` redirect to the `https://` URL:

```bash
curl -I http://example.com
```

## Related

- [TLS certificates](../../platform/hosts/applications/tls-certificates.md)
- [Add custom HTTP headers](custom-http-headers.md)
- [TLS certificate problems](../../troubleshooting/tls-certificate-issues.md)